Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
26-06-2024 21:59
Static task
static1
Behavioral task
behavioral1
Sample
139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
139c407f18afa076d2b84d9e9a976dde
-
SHA1
2f52a86e60931efd85b1297d485d024fb705e887
-
SHA256
8383502063bfc21e46558865c747ef9ca8023b46732c1cef09467e51c60331cb
-
SHA512
b86e131e17bb7ac254dc8cf8c877e7c6bf90dd50b267818b08b2df93503816663ca9caa0cc18044b2057ad09651771c133459e1512713db18db59bdafbb792d9
-
SSDEEP
24576:3Pns0XeQ2sPtysnGgeFC9A9fCG5qigd512vwyMR:fs0XeD2vTcCmqEJgdawj
Malware Config
Extracted
darkcomet
ÓÇã
nnns.zapto.org:1604
DC_MUTEX-F54S21D
-
gencode
pZ2PbkJ4J7qu
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exedescription pid process target process PID 1936 set thread context of 2636 1936 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exedescription pid process Token: SeIncreaseQuotaPrivilege 2636 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeSecurityPrivilege 2636 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2636 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2636 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2636 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeSystemtimePrivilege 2636 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2636 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2636 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2636 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeBackupPrivilege 2636 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeRestorePrivilege 2636 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeShutdownPrivilege 2636 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeDebugPrivilege 2636 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2636 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2636 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2636 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeUndockPrivilege 2636 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeManageVolumePrivilege 2636 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeImpersonatePrivilege 2636 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2636 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: 33 2636 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: 34 2636 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: 35 2636 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exepid process 1936 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe 2636 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exedescription pid process target process PID 1936 wrote to memory of 2636 1936 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe PID 1936 wrote to memory of 2636 1936 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe PID 1936 wrote to memory of 2636 1936 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe PID 1936 wrote to memory of 2636 1936 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe PID 1936 wrote to memory of 2636 1936 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe PID 1936 wrote to memory of 2636 1936 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe PID 1936 wrote to memory of 2636 1936 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe PID 1936 wrote to memory of 2636 1936 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe PID 1936 wrote to memory of 2636 1936 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe PID 1936 wrote to memory of 2636 1936 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe PID 1936 wrote to memory of 2636 1936 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe PID 1936 wrote to memory of 2636 1936 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe PID 1936 wrote to memory of 2636 1936 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe PID 1936 wrote to memory of 2636 1936 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe PID 1936 wrote to memory of 2636 1936 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe"2⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2636